-
CVE-2022-21816 NVIDIA vGPU software vulnerability details (7th Feb, 2022)
Preface: In addition to the traditional CVE risk level criteria, the critical level of vulnerability risk will depend on the processing technique. Background: NVIDIA vGPU software is a graphics virtualization platform that provides virtual machines (VMs) access to NVIDIA GPU technology. In order to fulfill design objective, it is necessary enable an GPUDirect RDMA connection…
-
About CVE-2022-23206 – Apache (Traffic Control) design weakness (6th Feb, 2022)
Preface: The traditional content distribution network (CDN) can no longer meet the specifications of 5G networks because it requires high bandwidth, low latency and on demand massive connections. The bottlenecks of traditional CDN cannot been resolved the rapidly growth in video traffic, rate, and cost. Background: Apache Traffic Server™ software is a fast, scalable and…
-
CVE-2022-23833 – Django triggers an infinite loop when parsing a file. Since design defects consume resources on their own, they may cause denial of service. (3rd Feb, 2022)
Preface: If the loop can be influenced by an attacker, this weakness could allow attackers to consume excessive resources such as CPU or memory. Background: Django itself is web framework used for developing web applications based on python. Which is used for making development proccess more simple and easy. It provides various built in things…
-
About CVE-2022-24122 – Vulnerability resolved two and a half months ago. Just to understanding what is happened (29-01-2022)
Preface: If you are a Kubernetes administrator, doing the resources distribution, may be it is a daily routine job. Regarding to this vulnerability, have you resolve yet? Background: Namespaces are one of the main features of the Linux kernel – they carry out the distinction between kernel resources. It makes sure that a process can…
-
Some said “php echo call” potential risk (CVE-2022-23993) let small to medium enterprise firm headache? But now it’s fixed. (26th Jan, 2022)
Preface: If no open source software concept in our world, technology is hard to become common. Even though you concern cyber security. They can fixed it when there is vulnerability occurs. Background: pfSense is an open source firewall and routing platform based on FreeBSD. pfSense can be installed on physical computers or virtual machines, and…
-
OpenSUSE Backports SLE-15-SP3 watchman suffers from design flaw (26-01-2022)
Preface: What are backports in traditional Linux?“Backporting” is the process of making new software run on something old. A version of something new that’s been modified to run on something old is called a “backport”. The Backports Project develops tools to automate the backporting process for Linux drivers. These tools form the backports suite. Background:…
-
Does this concept like CVE-2022-23008? (26-01-2022)
Preface: NGINX Controller provides lightning-fast application delivery and API management for modern app teams. Background: What is a Data Plane? The data plane is a layer of service proxies that manage application-level network traffic. Data plane typically operate on Layer 7 (application) traffic, although they may also operate at Layer 4 (transport) traffic as well.…
-
CVE-2022-23852 – Prevent Expat (XML_GetBuffer) Signed integer overflow (24-01-2022)
Preface: Expat is free software. You may copy, distribute, and modify it under the terms of the License contained in the file COPYING distributed with this package. This license is the same as the MIT/X Consortium license. Background: As a open-source XML parser, Expat can be implemented by several programming languages, such as: Python, PHP,Perl,…etc.…
-
Are you worried when jerryscript has vulnerabilities? (24th Jan, 2022)
Preface: Samsung Electronics has started the development of IoT.js on 2015, a platform for IoT applications written in JavaScript, and JerryScript, a JavaScript engine for small, embedded devices. Background: JerryScript is an ultra-lightweight JavaScript engine for the Internet of things. It is capable of executing ECMAScript 5.1 source code on devices with less than 64…
-
Get rid of crafted Modbus traffic to bother your defense mechansim – 21st JAN 2022
Preface: Le Rouge et le Noir – Not a bad guy is good guy. If, the vulnerability is due to an integer overflow when handling Modbus traffic. Is it an early warning? Background: The reason Modbus was so successful was the fact that it could be so readily understood by non-programmers. Engineers who built glue…